KameleonFuzz: Evolutionary Fuzzing for Black-Box XSS Detection - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2014

KameleonFuzz: Evolutionary Fuzzing for Black-Box XSS Detection


We present a black-box based smart fuzzing approach to detect cross-site scripting (XSS) vulnerabilities in web applications. The smartness is attributed to model inference and automated malicious input generation. The former is implemented as a state-aware crawler which models the application as an automaton. The second component, evolutionary fuzzing, uses genetic algorithm (GA). To limit its search space, we introduce an Attack Grammar that mimics attackers by generating malicious inputs. XSS are characterized by a relationship between tainted input and output of the web application. In black-box testing, precisely capturing this relationship is a non-trivial task that we solve using taint inference techniques. By doing so, we focus only on the transitions wherein this relationship holds and thereby avoid to fuzz the whole system. GA automates the process of generating inputs by considering the states of the application and evolving the inputs to trigger XSS, if any. Empirical evaluation shows that our fuzzer detects vulnerabilities missed by other blackbox scanners.
No file

Dates and versions

hal-00976132 , version 1 (09-04-2014)



Fabien Duchene, Sanjay Rawat, Jean-Luc Richier, Roland Groz. KameleonFuzz: Evolutionary Fuzzing for Black-Box XSS Detection. Fourth ACM Conference on Data and Application Security and Privacy (CODASPY 2014), 2014, Unknown, pp.37-48, ⟨10.1145/2557547.2557550⟩. ⟨hal-00976132⟩
538 View
0 Download



Gmail Facebook X LinkedIn More